@safets-org/cli 1.0.0

package/dist/detectors/index.js

@@ -0,0 +1,785 @@
+import ts from "typescript";
+import { getChainRoot, hasNonNullAssertion, isInsideTryCatch, isNullable, isOptionalAccess, isSubChainDuplicate, pos, } from "../utils/ast.js";
+export function detectFallbackPatterns(sf) {
+    const results = [];
+    function visit(node) {
+        if (ts.isCallExpression(node) &&
+            ts.isPropertyAccessExpression(node.expression) &&
+            node.expression.name.getText() === "parse" &&
+            node.expression.expression.getText() === "JSON" &&
+            !isInsideTryCatch(node)) {
+            const { line, col } = pos(sf, node);
+            results.push({
+                file: sf.fileName,
+                line,
+                col,
+                expr: node.getText(),
+                rootExpr: "JSON.parse",
+                type: "unknown",
+                pattern: "Unprotected JSON.parse",
+                confidence: "HIGH",
+                fallback: true,
+                crashPath: [
+                    "JSON.parse(input) - throws SyntaxError if input is malformed",
+                    "Unhandled exception -> process crash",
+                ],
+            });
+        }
+        if (ts.isNonNullExpression(node) &&
+            ts.isPropertyAccessExpression(node.expression) &&
+            ts.isPropertyAccessExpression(node.expression.expression) &&
+            node.expression.expression.expression.getText() === "process" &&
+            node.expression.expression.name.getText() === "env") {
+            const envVar = node.expression.name.getText();
+            const { line, col } = pos(sf, node);
+            results.push({
+                file: sf.fileName,
+                line,
+                col,
+                expr: node.getText(),
+                rootExpr: `process.env.${envVar}`,
+                type: "string | undefined",
+                pattern: "Unsafe process.env access",
+                confidence: "HIGH",
+                fallback: true,
+                crashPath: [
+                    `process.env.${envVar}! - non-null assertion used`,
+                    `If ${envVar} is not set, crash is silently bypassed by compiler`,
+                ],
+            });
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sf);
+    return results;
+}
+export function detectUnsafePropertyAccess(sf, checker) {
+    const results = [];
+    function visit(node) {
+        if (ts.isPropertyAccessExpression(node)) {
+            if (isOptionalAccess(node) || hasNonNullAssertion(node) || isSubChainDuplicate(node, checker)) {
+                ts.forEachChild(node, visit);
+                return;
+            }
+            try {
+                const objectType = checker.getTypeAtLocation(node.expression);
+                if (isNullable(objectType)) {
+                    const { line, col } = pos(sf, node);
+                    const prop = node.name.getText();
+                    const objectExpr = node.expression.getText();
+                    results.push({
+                        file: sf.fileName,
+                        line,
+                        col,
+                        expr: node.getText(),
+                        rootExpr: getChainRoot(node.expression).getText(),
+                        type: checker.typeToString(objectType),
+                        pattern: "Unsafe property access",
+                        confidence: "HIGH",
+                        crashPath: [
+                            `${objectExpr} -> ${checker.typeToString(objectType)}`,
+                            `${objectExpr} may be undefined at runtime`,
+                            `${objectExpr}.${prop} -> Cannot read properties of undefined (reading '${prop}')`,
+                        ],
+                    });
+                }
+            }
+            catch {
+                // Ignore nodes where type resolution fails.
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sf);
+    return results;
+}
+export function detectUnsafeDestructuring(sf, checker) {
+    const results = [];
+    function visit(node) {
+        if (ts.isVariableDeclaration(node) &&
+            node.initializer &&
+            ts.isObjectBindingPattern(node.name)) {
+            try {
+                const initialType = checker.getTypeAtLocation(node.initializer);
+                if (isNullable(initialType)) {
+                    const { line, col } = pos(sf, node);
+                    const initializerText = node.initializer.getText();
+                    results.push({
+                        file: sf.fileName,
+                        line,
+                        col,
+                        expr: `const ${node.name.getText()} = ${initializerText}`,
+                        rootExpr: initializerText,
+                        type: checker.typeToString(initialType),
+                        pattern: "Unsafe destructuring",
+                        confidence: "HIGH",
+                        crashPath: [
+                            `${initializerText} -> ${checker.typeToString(initialType)}`,
+                            "Cannot destructure property of undefined",
+                        ],
+                    });
+                }
+            }
+            catch {
+                // Ignore nodes where type resolution fails.
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sf);
+    return results;
+}
+export function detectUnsafeArrayAccess(sf, checker) {
+    const results = [];
+    function visit(node) {
+        if (ts.isPropertyAccessExpression(node) &&
+            ts.isElementAccessExpression(node.expression) &&
+            node.questionDotToken === undefined) {
+            try {
+                const elementType = checker.getTypeAtLocation(node.expression);
+                if (isNullable(elementType)) {
+                    const { line, col } = pos(sf, node);
+                    const arrayExpr = node.expression.getText();
+                    const prop = node.name.getText();
+                    results.push({
+                        file: sf.fileName,
+                        line,
+                        col,
+                        expr: node.getText(),
+                        rootExpr: arrayExpr,
+                        type: checker.typeToString(elementType),
+                        pattern: "Unsafe array index access",
+                        confidence: "HIGH",
+                        crashPath: [
+                            `${arrayExpr} -> ${checker.typeToString(elementType)} (may be out of bounds)`,
+                            `${arrayExpr}.${prop} -> Cannot read properties of undefined (reading '${prop}')`,
+                        ],
+                    });
+                }
+            }
+            catch {
+                // Ignore nodes where type resolution fails.
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sf);
+    return results;
+}
+export function detectUnsafeJsonParse(sf) {
+    const results = [];
+    function visit(node) {
+        if (ts.isCallExpression(node) &&
+            ts.isPropertyAccessExpression(node.expression) &&
+            node.expression.name.getText() === "parse" &&
+            node.expression.expression.getText() === "JSON" &&
+            !isInsideTryCatch(node)) {
+            const { line, col } = pos(sf, node);
+            results.push({
+                file: sf.fileName,
+                line,
+                col,
+                expr: node.getText(),
+                rootExpr: "JSON.parse",
+                type: "unknown",
+                pattern: "Unprotected JSON.parse",
+                confidence: "HIGH",
+                crashPath: [
+                    "JSON.parse(input) - throws SyntaxError if input is malformed",
+                    "Unhandled exception -> process crash",
+                ],
+            });
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sf);
+    return results;
+}
+export function detectUnsafeEnvAccess(sf, checker) {
+    const results = [];
+    function isEnvAccess(candidate) {
+        return (ts.isPropertyAccessExpression(candidate) &&
+            ts.isPropertyAccessExpression(candidate.expression) &&
+            ts.isIdentifier(candidate.expression.expression) &&
+            candidate.expression.expression.text === "process" &&
+            ts.isIdentifier(candidate.expression.name) &&
+            candidate.expression.name.text === "env");
+    }
+    function isSafelyDefaulted(node) {
+        let current = node;
+        let foundDefault = false;
+        let pendingNonNullWrappers = [];
+        const allowedNonNullWrappers = new Set();
+        function containsEnvAccess(child) {
+            let found = false;
+            function visitEnv(candidate) {
+                if (isEnvAccess(candidate)) {
+                    found = true;
+                    return;
+                }
+                ts.forEachChild(candidate, visitEnv);
+            }
+            visitEnv(child);
+            return found;
+        }
+        function isUnsafeNonNullEnvExpression(candidate) {
+            if (!ts.isNonNullExpression(candidate) ||
+                !containsEnvAccess(candidate.expression) ||
+                allowedNonNullWrappers.has(candidate)) {
+                return false;
+            }
+            try {
+                return isNullable(checker.getTypeAtLocation(candidate.expression));
+            }
+            catch {
+                return true;
+            }
+        }
+        function hasUnsafeEnvNonNullAssertionOnPath(start, root) {
+            let candidate = start;
+            while (candidate) {
+                if (isUnsafeNonNullEnvExpression(candidate)) {
+                    return true;
+                }
+                if (candidate === root) {
+                    return false;
+                }
+                candidate = candidate.parent;
+            }
+            return false;
+        }
+        while (true) {
+            while (ts.isParenthesizedExpression(current.parent) ||
+                ts.isNonNullExpression(current.parent)) {
+                if (ts.isNonNullExpression(current.parent)) {
+                    pendingNonNullWrappers.push(current.parent);
+                }
+                current = current.parent;
+            }
+            const parent = current.parent;
+            if (!ts.isBinaryExpression(parent) ||
+                (parent.operatorToken.kind !== ts.SyntaxKind.QuestionQuestionToken &&
+                    parent.operatorToken.kind !== ts.SyntaxKind.BarBarToken)) {
+                break;
+            }
+            if (parent.left === current) {
+                if (ts.isNonNullExpression(current) && isEnvAccess(current.expression)) {
+                    allowedNonNullWrappers.add(current);
+                }
+                pendingNonNullWrappers.forEach((wrapper) => allowedNonNullWrappers.add(wrapper));
+                foundDefault = true;
+            }
+            pendingNonNullWrappers = [];
+            current = parent;
+        }
+        if (!foundDefault || hasUnsafeEnvNonNullAssertionOnPath(node, current)) {
+            return false;
+        }
+        try {
+            return !isNullable(checker.getTypeAtLocation(current));
+        }
+        catch {
+            return false;
+        }
+    }
+    function visit(node) {
+        if (isEnvAccess(node) &&
+            !isSafelyDefaulted(node) &&
+            !ts.isNonNullExpression(node.parent)) {
+            try {
+                const envVar = node.name.getText();
+                const envType = checker.getTypeAtLocation(node);
+                if (isNullable(envType)) {
+                    const { line, col } = pos(sf, node);
+                    results.push({
+                        file: sf.fileName,
+                        line,
+                        col,
+                        expr: node.getText(),
+                        rootExpr: `process.env.${envVar}`,
+                        type: checker.typeToString(envType),
+                        pattern: "Unsafe process.env access",
+                        confidence: "HIGH",
+                        crashPath: [
+                            `process.env.${envVar} -> string | undefined`,
+                            "If not set in environment -> crash",
+                        ],
+                    });
+                }
+            }
+            catch {
+                // Ignore nodes where type resolution fails.
+            }
+        }
+        if (ts.isNonNullExpression(node) &&
+            isEnvAccess(node.expression) &&
+            !isSafelyDefaulted(node)) {
+            const envVar = node.expression.name.getText();
+            const { line, col } = pos(sf, node);
+            results.push({
+                file: sf.fileName,
+                line,
+                col,
+                expr: node.getText(),
+                rootExpr: `process.env.${envVar}`,
+                type: "string | undefined",
+                pattern: "Unsafe process.env access",
+                confidence: "HIGH",
+                crashPath: [
+                    `process.env.${envVar}! - non-null assertion`,
+                    "If missing, crash is silently bypassed by compiler",
+                ],
+            });
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sf);
+    return results;
+}
+export function detectNonNullAssertionOnNullable(sf, checker) {
+    const results = [];
+    function visit(node) {
+        if (ts.isNonNullExpression(node)) {
+            if (node.expression.getText().startsWith("process.env")) {
+                ts.forEachChild(node, visit);
+                return;
+            }
+            try {
+                const innerType = checker.getTypeAtLocation(node.expression);
+                if (isNullable(innerType)) {
+                    const { line, col } = pos(sf, node);
+                    results.push({
+                        file: sf.fileName,
+                        line,
+                        col,
+                        expr: node.getText(),
+                        rootExpr: node.expression.getText(),
+                        type: checker.typeToString(innerType),
+                        pattern: "Non-null assertion on nullable",
+                        confidence: "MEDIUM",
+                        crashPath: [
+                            `${node.expression.getText()} -> ${checker.typeToString(innerType)}`,
+                            "! suppresses the TypeScript error",
+                            "If undefined at runtime -> crash",
+                        ],
+                    });
+                }
+            }
+            catch {
+                // Ignore nodes where type resolution fails.
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sf);
+    return results;
+}
+export function detectUnsafeAccessAfterAwait(sf, checker) {
+    const results = [];
+    function analyzeFunction(body) {
+        const narrowedVarTypes = new Map();
+        const callableBodies = new Map();
+        const callStack = new Set();
+        function isFunctionLike(node) {
+            return (ts.isFunctionDeclaration(node) ||
+                ts.isMethodDeclaration(node) ||
+                ts.isArrowFunction(node) ||
+                ts.isFunctionExpression(node));
+        }
+        function isImmediatelyInvokedFunction(node) {
+            let current = node;
+            while (ts.isParenthesizedExpression(current.parent)) {
+                current = current.parent;
+            }
+            return ts.isCallExpression(current.parent) && current.parent.expression === current;
+        }
+        function collectCallableBodies(node) {
+            if (ts.isFunctionDeclaration(node)) {
+                const symbol = node.name ? checker.getSymbolAtLocation(node.name) : undefined;
+                if (symbol && node.body) {
+                    callableBodies.set(symbol, node.body);
+                    collectCallableBodies(node.body);
+                }
+                return;
+            }
+            if (ts.isVariableDeclaration(node) &&
+                ts.isIdentifier(node.name) &&
+                node.initializer &&
+                (ts.isFunctionExpression(node.initializer) || ts.isArrowFunction(node.initializer))) {
+                const symbol = checker.getSymbolAtLocation(node.name);
+                if (symbol) {
+                    callableBodies.set(symbol, node.initializer.body);
+                    collectCallableBodies(node.initializer.body);
+                }
+                return;
+            }
+            if (isFunctionLike(node)) {
+                return;
+            }
+            ts.forEachChild(node, collectCallableBodies);
+        }
+        function getEarlyReturnGuardIdentifier(node) {
+            const condition = unwrapExpression(node.expression);
+            let identifier = null;
+            function isNullishLiteral(candidate) {
+                return (candidate.kind === ts.SyntaxKind.NullKeyword ||
+                    (ts.isIdentifier(candidate) && candidate.text === "undefined"));
+            }
+            if (ts.isPrefixUnaryExpression(condition) &&
+                condition.operator === ts.SyntaxKind.ExclamationToken &&
+                ts.isIdentifier(unwrapExpression(condition.operand))) {
+                identifier = unwrapExpression(condition.operand);
+            }
+            if (ts.isBinaryExpression(condition)) {
+                const op = condition.operatorToken.kind;
+                if (op === ts.SyntaxKind.EqualsEqualsEqualsToken ||
+                    op === ts.SyntaxKind.EqualsEqualsToken) {
+                    const left = unwrapExpression(condition.left);
+                    const right = unwrapExpression(condition.right);
+                    if (ts.isIdentifier(left) && isNullishLiteral(right)) {
+                        identifier = left;
+                    }
+                    else if (ts.isIdentifier(right) && isNullishLiteral(left)) {
+                        identifier = right;
+                    }
+                }
+            }
+            if (!identifier) {
+                return null;
+            }
+            const isEarlyExit = (statement) => {
+                if (ts.isReturnStatement(statement) || ts.isThrowStatement(statement)) {
+                    return true;
+                }
+                if (ts.isBlock(statement)) {
+                    const lastStatement = statement.statements.at(-1);
+                    return lastStatement ? isEarlyExit(lastStatement) : false;
+                }
+                return (ts.isIfStatement(statement) &&
+                    !!statement.elseStatement &&
+                    isEarlyExit(statement.thenStatement) &&
+                    isEarlyExit(statement.elseStatement));
+            };
+            if (!isEarlyExit(node.thenStatement)) {
+                return null;
+            }
+            return identifier;
+        }
+        function getEarlyReturnGuard(node) {
+            const identifier = getEarlyReturnGuardIdentifier(node);
+            if (!identifier) {
+                return null;
+            }
+            try {
+                const symbol = checker.getSymbolAtLocation(identifier);
+                if (!symbol) {
+                    return null;
+                }
+                const existing = narrowedVarTypes.get(symbol);
+                if (existing) {
+                    return {
+                        symbol,
+                        name: existing.name,
+                        type: existing.type,
+                    };
+                }
+                const type = checker.getTypeAtLocation(identifier);
+                if (!isNullable(type)) {
+                    return null;
+                }
+                return {
+                    symbol,
+                    name: identifier.getText(),
+                    type: checker.typeToString(type),
+                };
+            }
+            catch {
+                return null;
+            }
+        }
+        function getAssignmentTargets(node) {
+            if (!ts.isBinaryExpression(node) ||
+                node.operatorToken.kind < ts.SyntaxKind.FirstAssignment ||
+                node.operatorToken.kind > ts.SyntaxKind.LastAssignment) {
+                return [];
+            }
+            const symbols = [];
+            function collectIdentifierTargets(target) {
+                if (ts.isIdentifier(target)) {
+                    const symbol = checker.getSymbolAtLocation(target);
+                    if (symbol) {
+                        symbols.push(symbol);
+                    }
+                    return;
+                }
+                if (ts.isArrayLiteralExpression(target)) {
+                    target.elements.forEach(collectIdentifierTargets);
+                    return;
+                }
+                if (ts.isObjectLiteralExpression(target)) {
+                    for (const property of target.properties) {
+                        if (ts.isShorthandPropertyAssignment(property)) {
+                            collectIdentifierTargets(property.name);
+                        }
+                        else if (ts.isPropertyAssignment(property)) {
+                            collectIdentifierTargets(property.initializer);
+                        }
+                        else if (ts.isSpreadAssignment(property)) {
+                            collectIdentifierTargets(property.expression);
+                        }
+                    }
+                }
+            }
+            collectIdentifierTargets(node.left);
+            return symbols;
+        }
+        function unwrapExpression(expression) {
+            let current = expression;
+            while (ts.isParenthesizedExpression(current)) {
+                current = current.expression;
+            }
+            return current;
+        }
+        function isOutermostPropertyAccess(node) {
+            return !(ts.isPropertyAccessExpression(node.parent) &&
+                node.parent.questionDotToken === undefined);
+        }
+        function analyzeCalledClosure(symbol, activeAfterAwait, activeNarrowings, assignedSymbols) {
+            const calledBody = callableBodies.get(symbol);
+            if (!calledBody || callStack.has(symbol)) {
+                return;
+            }
+            callStack.add(symbol);
+            const closureAssignments = new Set();
+            if (ts.isBlock(calledBody)) {
+                findViolationsInBlock(calledBody, new Set(activeAfterAwait), new Set(activeNarrowings), closureAssignments);
+            }
+            else {
+                findViolations(calledBody, new Set(activeAfterAwait), new Set(activeNarrowings), closureAssignments);
+            }
+            callStack.delete(symbol);
+            closureAssignments.forEach((assignedSymbol) => {
+                assignedSymbols.add(assignedSymbol);
+                activeAfterAwait.delete(assignedSymbol);
+                activeNarrowings.delete(assignedSymbol);
+            });
+        }
+        function findViolations(node, activeAfterAwait, activeNarrowings, assignedSymbols) {
+            if (isFunctionLike(node)) {
+                if (isImmediatelyInvokedFunction(node)) {
+                    const iifeAssignments = new Set();
+                    ts.forEachChild(node, (child) => findViolations(child, new Set(activeAfterAwait), new Set(activeNarrowings), iifeAssignments));
+                    iifeAssignments.forEach((assignedSymbol) => {
+                        assignedSymbols.add(assignedSymbol);
+                        activeAfterAwait.delete(assignedSymbol);
+                        activeNarrowings.delete(assignedSymbol);
+                    });
+                }
+                return;
+            }
+            if (ts.isBlock(node)) {
+                const isConditionalBranch = ts.isIfStatement(node.parent) &&
+                    (node.parent.thenStatement === node || node.parent.elseStatement === node);
+                const blockAfterAwait = new Set(activeAfterAwait);
+                const blockNarrowings = new Set(activeNarrowings);
+                const blockAssignments = new Set();
+                findViolationsInBlock(node, blockAfterAwait, blockNarrowings, blockAssignments);
+                if (isConditionalBranch) {
+                    blockAfterAwait.forEach((symbol) => activeAfterAwait.add(symbol));
+                    blockAssignments.forEach((assignedSymbol) => {
+                        assignedSymbols.add(assignedSymbol);
+                        // A conditional assignment breaks narrowing, but sibling paths may still be post-await.
+                        activeNarrowings.delete(assignedSymbol);
+                    });
+                    return;
+                }
+                activeAfterAwait.clear();
+                blockAfterAwait.forEach((symbol) => activeAfterAwait.add(symbol));
+                activeNarrowings.clear();
+                blockNarrowings.forEach((symbol) => activeNarrowings.add(symbol));
+                blockAssignments.forEach((assignedSymbol) => assignedSymbols.add(assignedSymbol));
+                return;
+            }
+            const assignmentTargets = getAssignmentTargets(node);
+            if (ts.isAwaitExpression(node)) {
+                ts.forEachChild(node, (child) => findViolations(child, activeAfterAwait, activeNarrowings, assignedSymbols));
+                activeNarrowings.forEach((symbol) => activeAfterAwait.add(symbol));
+                return;
+            }
+            if (ts.isPropertyAccessExpression(node) && activeAfterAwait.size > 0) {
+                const root = getChainRoot(node.expression);
+                const rootSymbol = ts.isIdentifier(root)
+                    ? checker.getSymbolAtLocation(root)
+                    : undefined;
+                if (rootSymbol &&
+                    activeAfterAwait.has(rootSymbol) &&
+                    !isOptionalAccess(node) &&
+                    !hasNonNullAssertion(node) &&
+                    !isSubChainDuplicate(node, checker) &&
+                    isOutermostPropertyAccess(node)) {
+                    try {
+                        const { line, col } = pos(sf, node);
+                        const originalType = narrowedVarTypes.get(rootSymbol);
+                        if (!originalType) {
+                            ts.forEachChild(node, (child) => findViolations(child, activeAfterAwait, activeNarrowings, assignedSymbols));
+                            return;
+                        }
+                        results.push({
+                            file: sf.fileName,
+                            line,
+                            col,
+                            expr: node.getText(),
+                            rootExpr: originalType.name,
+                            type: originalType.type,
+                            pattern: "Unsafe access after await",
+                            confidence: "MEDIUM",
+                            crashPath: [
+                                `${originalType.name} narrowed from ${originalType.type} to defined`,
+                                "await suspended execution - external state may have changed",
+                                `${originalType.name} may be undefined again after resuming`,
+                                `${node.getText()} -> Cannot read properties of undefined`,
+                            ],
+                        });
+                    }
+                    catch {
+                        // Ignore nodes where type resolution fails.
+                    }
+                }
+            }
+            if (ts.isCallExpression(node) &&
+                ts.isIdentifier(node.expression) &&
+                (activeAfterAwait.size > 0 || activeNarrowings.size > 0)) {
+                const symbol = checker.getSymbolAtLocation(node.expression);
+                if (symbol) {
+                    analyzeCalledClosure(symbol, activeAfterAwait, activeNarrowings, assignedSymbols);
+                }
+            }
+            ts.forEachChild(node, (child) => findViolations(child, activeAfterAwait, activeNarrowings, assignedSymbols));
+            for (const assignmentTarget of assignmentTargets) {
+                assignedSymbols.add(assignmentTarget);
+                activeNarrowings.delete(assignmentTarget);
+                activeAfterAwait.delete(assignmentTarget);
+            }
+        }
+        function findViolationsInBlock(block, activeAfterAwait = new Set(), activeNarrowings = new Set(), assignedSymbols = new Set()) {
+            for (const statement of block.statements) {
+                findViolations(statement, activeAfterAwait, activeNarrowings, assignedSymbols);
+                if (ts.isIfStatement(statement)) {
+                    const guard = getEarlyReturnGuard(statement);
+                    if (guard) {
+                        narrowedVarTypes.set(guard.symbol, {
+                            name: guard.name,
+                            type: guard.type,
+                        });
+                        activeAfterAwait.delete(guard.symbol);
+                        activeNarrowings.add(guard.symbol);
+                    }
+                }
+            }
+        }
+        collectCallableBodies(body);
+        findViolationsInBlock(body);
+    }
+    function visit(node) {
+        if ((ts.isFunctionDeclaration(node) ||
+            ts.isMethodDeclaration(node) ||
+            ts.isArrowFunction(node) ||
+            ts.isFunctionExpression(node)) &&
+            node.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) &&
+            node.body &&
+            ts.isBlock(node.body)) {
+            analyzeFunction(node.body);
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sf);
+    return results;
+}
+export function detectUnsafePromiseAllDestructuring(sf, checker) {
+    const results = [];
+    function visit(node) {
+        if (ts.isVariableDeclaration(node) &&
+            ts.isArrayBindingPattern(node.name) &&
+            node.initializer &&
+            ts.isAwaitExpression(node.initializer)) {
+            const awaitedExpr = node.initializer.expression;
+            if (ts.isCallExpression(awaitedExpr) &&
+                ts.isPropertyAccessExpression(awaitedExpr.expression) &&
+                awaitedExpr.expression.name.getText() === "all" &&
+                awaitedExpr.expression.expression.getText() === "Promise") {
+                try {
+                    const initType = checker.getTypeAtLocation(node.initializer);
+                    const typeString = checker.typeToString(initType);
+                    if (isNullable(initType) || typeString.includes("undefined")) {
+                        const { line, col } = pos(sf, node);
+                        results.push({
+                            file: sf.fileName,
+                            line,
+                            col,
+                            expr: node.getText(),
+                            rootExpr: "Promise.all",
+                            type: typeString,
+                            pattern: "Unsafe Promise.all destructuring",
+                            confidence: "MEDIUM",
+                            crashPath: [
+                                "Promise.all result destructured - elements may be undefined",
+                                "Accessing properties on undefined -> crash",
+                            ],
+                        });
+                    }
+                }
+                catch {
+                    // Ignore nodes where type resolution fails.
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sf);
+    return results;
+}
+export function detectUnsafeMapAccess(sf, checker) {
+    const results = [];
+    function visit(node) {
+        if (ts.isPropertyAccessExpression(node) &&
+            ts.isElementAccessExpression(node.expression) &&
+            node.questionDotToken === undefined) {
+            try {
+                const containerType = checker.getTypeAtLocation(node.expression.expression);
+                const containerString = checker.typeToString(containerType);
+                const isMapLike = containerString.includes("Record<") ||
+                    containerString.includes("Map<") ||
+                    containerString.includes("{ [") ||
+                    containerString.includes("Index");
+                if (isMapLike) {
+                    const elementType = checker.getTypeAtLocation(node.expression);
+                    if (isNullable(elementType)) {
+                        const { line, col } = pos(sf, node);
+                        const mapExpr = node.expression.getText();
+                        const prop = node.name.getText();
+                        results.push({
+                            file: sf.fileName,
+                            line,
+                            col,
+                            expr: node.getText(),
+                            rootExpr: mapExpr,
+                            type: checker.typeToString(elementType),
+                            pattern: "Unsafe Map/Record access",
+                            confidence: "HIGH",
+                            crashPath: [
+                                `${mapExpr} -> ${checker.typeToString(elementType)} (key may not exist)`,
+                                `${mapExpr}.${prop} -> Cannot read properties of undefined (reading '${prop}')`,
+                            ],
+                        });
+                    }
+                }
+            }
+            catch {
+                // Ignore nodes where type resolution fails.
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sf);
+    return results;
+}